Heap-based buffer overflow in Microsoft Windows and Windows Server - CVE-2026-97804

Vulnerability details

The vulnerability allows a local user to escalate privileges and create or delete files in the security context of the NT AUTHORITYLOCAL SERVICE account.

The vulnerability exists due to a heap-based buffer overflow in the HID class driver when the driver is used locally. A local user can exploit this buffer overflow to escalate privileges and create or delete files in the security context of the NT AUTHORITYLOCAL SERVICE account.

Affected software

How to mitigate CVE-2026-97804

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97804
• https://support.microsoft.com/help/5127648

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Windows